Skip to content

fix: use bounded read for bundle download HTTP responses #3764

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Quratulain-bilal wants to merge 1 commit into
base: main
Choose a base branch
from
+32 −1
Open

fix: use bounded read for bundle download HTTP responses #3764

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion src/specify_cli/commands/bundle/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@

import typer

from ..._download_security import MAX_DOWNLOAD_BYTES, read_response_limited
from ..._console import console, err_console
from ...bundler import BundlerError
from ...bundler.lib.project import (
Expand Down Expand Up @@ -879,7 +880,7 @@ def _validate_redirect(old_url: str, new_url: str) -> None:
extra_headers=extra_headers,
) as resp:
_require_https(f"bundle '{entry_id}'", resp.geturl())
raw = resp.read()
raw = read_response_limited(resp, max_bytes=MAX_DOWNLOAD_BYTES)

@Quratulain-bilal Quratulain-bilal Jul 27, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added test_bundle_download_rejects_oversized_response which monkeypatches MAX_DOWNLOAD_BYTES to 100, serves 200 bytes via a fake response, and asserts the command fails with exceeds maximum size of 100 bytes. This proves the size-limit bound is retained in the bundle CLI download path.

except BundlerError:
raise
except Exception as exc: # noqa: BLE001
Expand Down
30 changes: 30 additions & 0 deletions tests/contract/test_bundle_cli.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -767,3 +767,33 @@ def fake_open_url(url, timeout=None, extra_headers=None, redirect_validator=None

payload = json.loads(result.output)
assert payload["id"] == "demo-bundle"


def test_bundle_download_rejects_oversized_response(project: Path, monkeypatch):
"""Bundle download rejects responses exceeding MAX_DOWNLOAD_BYTES."""
# Monkeypatch to a small limit so the test is fast and low-memory.
monkeypatch.setattr(
"specify_cli.commands.bundle.MAX_DOWNLOAD_BYTES", 100
)

api_asset_url = "https://api.github.com/repos/org/repo/releases/assets/99"

def fake_open_url(url, timeout=None, extra_headers=None, redirect_validator=None):
# Return a response that exceeds 100 bytes.
return FakeBundleResponse(b"x" * 200, url=api_asset_url)

catalog = project / "catalog.json"
write_catalog_file(
catalog,
{"demo-bundle": catalog_entry_dict("demo-bundle", download_url=api_asset_url)},
)
_make_catalog_config(catalog, project)

with patch("specify_cli.authentication.http.open_url", side_effect=fake_open_url):
result = runner.invoke(app, ["bundle", "info", "demo-bundle", "--json"])

# Must fail with a size-limit error, not an unhandled traceback.
assert result.exit_code == 1
# Rich may wrap the message across lines; normalise whitespace before checking.
output_flat = " ".join(result.output.split())
assert "exceeds maximum size of 100 bytes" in output_flat